gh-123067: Fix quadratic complexity in parsing cookies with backslashes#123075

Merged

serhiy-storchaka merged 4 commits intopython:mainfrom

serhiy-storchaka:http-coockies-optimize-re

Aug 17, 2024

Member

serhiy-storchaka commented Aug 16, 2024 •

edited by bedevere-app bot

Loading

This fixes CVE-2024-7592.

Issue: CVE-2024-7592: Denial of Service Vulnerability in http.cookies._unquote() #123067

serhiy-storchaka added type-security needs backport to 3.8 needs backport to 3.10 needs backport to 3.11 needs backport to 3.12 needs backport to 3.13 labels

bedevere-app bot mentioned this pull request

CVE-2024-7592: Denial of Service Vulnerability in http.cookies._unquote() #123067

Closed

bedevere-app bot added the awaiting core review label


          pythongh-123067: Fix quadratic complexity in parsing cookies with bac…

04ac47b

…kslashes

This fixes CVE-2024-7592.

serhiy-storchaka force-pushed the http-coockies-optimize-re branch from 73e2aa9 to 04ac47b Compare

August 16, 2024 16:22

serhiy-storchaka mentioned this pull request

gh-123067: Denial of Service Vulnerability in http.cookies._unquote() #123066

Closed

serhiy-storchaka commented

View reviewed changes

Lib/test/test_http_cookies.py Outdated Show resolved Hide resolved


          Restore the current behavior for backslash-escaping.

ab87c99

picnixz reviewed

View reviewed changes

Lib/http/cookies.py Outdated Show resolved Hide resolved

Misc/NEWS.d/next/Library/2024-08-16-19-13-21.gh-issue-123067.Nx9O4R.rst Outdated Show resolved Hide resolved

sethmlarson approved these changes

View reviewed changes

Contributor

sethmlarson left a comment

Ran the new tests with and without the changes, the approach looks good to me! Thanks @serhiy-storchaka! 🙏

serhiy-storchaka added 2 commits

August 17, 2024 12:40


          Cache the sub() method, not the compiled pattern object.

1fe2492


          Add a reference to the module in NEWS.

8256ed2

picnixz approved these changes

View reviewed changes

serhiy-storchaka merged commit 44e4583 into python:main

miss-islington-app bot commented Aug 17, 2024

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

bedevere-app bot removed the awaiting core review label

serhiy-storchaka deleted the http-coockies-optimize-re branch

August 17, 2024 13:30

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

70390bb

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123103 is a backport of this pull request to the 3.13 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

6a33a68

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot removed the needs backport to 3.13 label

bedevere-app bot commented Aug 17, 2024

GH-123104 is a backport of this pull request to the 3.12 branch.

bedevere-app bot removed the needs backport to 3.12 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

dcfd909

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123105 is a backport of this pull request to the 3.11 branch.

bedevere-app bot removed the needs backport to 3.11 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

c4412d3

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123106 is a backport of this pull request to the 3.10 branch.

bedevere-app bot removed the needs backport to 3.10 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

15eec9d

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123107 is a backport of this pull request to the 3.9 branch.

bedevere-app bot removed the needs backport to 3.9 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

fa88d41

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123108 is a backport of this pull request to the 3.8 branch.

bedevere-app bot removed the needs backport to 3.8 label

jeremyhylton pushed a commit to jeremyhylton/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

rickprice added a commit to ActiveState/cpython that referenced this pull request


          CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie

6755e54

pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

rickprice added a commit to ActiveState/cpython that referenced this pull request


          CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie

ed12fce

pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

Redo tests without a subtest

Backport how RegEx stuff is handled to Python2

rickprice added a commit to ActiveState/cpython that referenced this pull request


          CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie

096104d

pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

rickprice mentioned this pull request

CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie ActiveState/cpython#62

Merged

blhsing pushed a commit to blhsing/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

f619de1

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

Akendo added a commit to gardenlinux/package-python3.12 that referenced this pull request


          Include upstream patch for python for CVE-2024-7592

031f522

We create a patch from the PR on GitHub that address the vulerability.

python/cpython#123075

Akendo mentioned this pull request

Include upstream patch for python for CVE-2024-7592 gardenlinux/package-python3.12#1

Closed

hauntsaninja pushed a commit that referenced this pull request


          [3.13] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

391e562

… values with backslashes (GH-123075) (#123103)

gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

hauntsaninja pushed a commit that referenced this pull request


          [3.12] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

dcc3eae

… values with backslashes (GH-123075) (#123104)

gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv pushed a commit that referenced this pull request


          [3.8] gh-123067: Fix quadratic complexity in parsing "-quoted cookie …

a77ab24

…values with backslashes (GH-123075) (#123108)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv pushed a commit that referenced this pull request


          [3.9] gh-123067: Fix quadratic complexity in parsing "-quoted cookie …

d662e2d

…values with backslashes (GH-123075) (#123107)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv pushed a commit that referenced this pull request


          [3.11] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

d4ac921

… values with backslashes (GH-123075) (#123105)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv pushed a commit that referenced this pull request


          [3.10] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

b2f11ca

… values with backslashes (GH-123075) (#123106)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

vEpiphyte mentioned this pull request

Add http.coookies monkeypatch (SYN-8465) vertexproject/synapse#4045

Merged

vEpiphyte added a commit to vertexproject/synapse that referenced this pull request


          Add http.coookies monkeypatch (SYN-8465) (#4045)

746605b

Vendor the fixes from CPython for
GHSA-7pwv-g7hj-39pr and applies them at
import time of `synapse.common`.

python/cpython#123067
python/cpython#123075

sajjaphani mentioned this pull request

[Security] Vulnerability found in Security vulnerability CVE-2024-7592 in package python habitat-sh/foundational-packages#64

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels